2025 Highlight Day 5: Strengthening Cyber Resilience in Scottish Local Authorities

This year, the Digital Office, in partnership with Scottish Government SC3, has been helping Scottish Local Authorities strengthen their resilience against cyber threats.

To ensure senior leaders are prepared, we offer facilitated tabletop cyber exercise sessions designed for Chief Executives, Board members, and Service Managers. These sessions put decision-makers in realistic scenarios so they know exactly how to respond if an incident occurs. Aligned with the NCSC Exercising Technical Standard, these exercises provide an invaluable opportunity to sharpen response strategies and build organisational confidence in the face of cyber risk.

Key Benefits for Councils:

Table-top Cyber Exercising sessions provide councils with the following benefits:

• Better Preparedness: Councils can practice what to do in real-life cyber incidents, so everyone knows their role and how to work together.
• Identifying gaps: These exercises help councils find gaps in their current plans, such as unclear responsibilities, outdated tools, or communication challenges.
• Improved Communication: The sessions encourage teams to work together and plan how to share information with staff, citizens, regulators, partners, and the media during a crisis.
• Increased  Awareness: By raising awareness of cyber risks, councils are more likely to keep essential services running, even if technology fails.
• More Confidence: Practising regularly helps staff feel more confident, so they can respond quickly and reduce the impact of any cyber incidents.

To make these benefits available to everyone, the Digital Office has launched a new Cyber Exercise Pack in the Digital Office Resource Centre, This pack empowers Scottish local authorities to run their own exercises and includes:

• An instruction manual
• A template for proposing cyber exercises
• Notes for facilitators
• Example slides for a strategic ransom and data theft scenario
• Hot de-brief documentation
• An after action report

Councils can use these resources on their own, or they can ask for a facilitated session from our Chief Information Security Officer, David Ritchie.

Dave Ritchie, Chief Information Security Officer: “Exercising should be a priority for all organisations. It shows where you’re strong and where you need to improve. With so many cyber attacks affecting the UK public sector, councils need to be ready for anything. Practising gives you the muscle memory for what you can control, which helps you deal with things that are out of your control. I hope this document pack inspires councils to run their own exercise, or contact the Digital Office to deliver one for them.

If you are interested in running a table-top cyber exercise for your local authority, please get in touch at info@digitaloffice.scot.